Infisical

Open source alternative to HashiCorp Vault, Doppler, AWS Secrets Manager, Akeyless, Azure Key Vault, Google Secret Manager and 1Password

30.3K stars
MIT
Active this week
Last commit today

Last verified Nov 4, 2026

Manage secrets, certificates, and privileged access in one self-hosted platform, in place of HashiCorp Vault and Doppler.

Visit website GitHub30.3K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Infisical is for#

DevOps teams managing credentials across multiple environments

Teams running services across development, staging, and production environments gain a central secrets store with environment-scoped access controls and secret syncs to CI/CD platforms like GitHub Actions, GitLab CI, and Vercel. Secret rotation and dynamic secrets remove the manual work of cycling credentials on a schedule.

Skip if:

If your team is already running HashiCorp Vault Enterprise with established workflows built around Vault's API, migrating mid-flight may outweigh the benefits. Infisical is better positioned as a greenfield choice or for teams whose current secrets setup is underpowered.

Security teams enforcing zero-standing-credentials on production infrastructure

PAM replaces shared admin credentials with just-in-time access brokered through Infisical. Engineers connect to production databases and SSH servers through the browser with sessions scoped to exactly what they need, automatically revoked when the access window closes. Session recording gives auditors a complete record.

Skip if:

If your organization already uses a dedicated PAM product with established compliance reporting workflows, adding Infisical for PAM alone may create duplication rather than consolidation.

Teams building or running AI agent workflows

Agent Vault gives each AI agent access to the APIs it calls through a proxy that never hands the agent a real credential. This directly addresses prompt-injection risk in multi-agent systems. Works with Claude Code, Codex, and custom agents; session logs are stored in your own S3 bucket.

Skip if:

If your AI agents only call internal services with no external API access, or if you already manage agent permissions through a service mesh with mutual TLS, Agent Vault may add more complexity than it removes.

Platform engineers setting up internal developer tooling

The Kubernetes operator delivers secrets as native Kubernetes Secrets and reloads deployments automatically on rotation. Nine language SDKs let application developers fetch secrets at runtime without storing them in environment files. The CLI injects secrets into local development without code changes.

Skip if:

If your team is small enough to manage secrets through a cloud provider's native secret store with no cross-cloud or on-premises workloads, the operational overhead of a self-hosted Infisical deployment may not be warranted.

the problem

The problem it solves#

Managing application credentials is unglamorous work that rarely gets dedicated tooling until after a breach or a lockout. API keys accumulate in .env files, database passwords get shared over chat, and production credentials occasionally appear in git history. When a team member leaves or a service key rotates, tracking down every place that credential appears is a manual audit with no guarantee of completeness.

The challenge compounds at scale. Each additional cloud service, CI pipeline, and Kubernetes workload needs credentials, but there is no central place to issue, rotate, or revoke them. Certificate expirations go unnoticed until a service goes down. Access to production databases relies on shared credentials with no session-level audit trail. Teams end up with credential state scattered across environment variable panels, configuration files, and secrets stores that diverge over time.

how Infisical solves it

How it solves it#

Secrets Management with Rotation and Dynamic Secrets

Store and version application secrets across development, staging, and production environments with AES-256-GCM encryption. Secret rotation handles scheduled credential changes for PostgreSQL, MySQL, and AWS IAM. Dynamic secrets generate ephemeral, short-lived credentials on demand for each database connection, so standing credentials never accumulate.

Certificate Lifecycle Management

Stand up private certificate authorities within Infisical and automate the full X.509 lifecycle: issuance, renewal, revocation, and expiry alerting. Integrates with Let's Encrypt, DigiCert, and Microsoft AD CS via ACME, EST, and SCEP. Certificate syncs push issued certs directly to AWS Certificate Manager and Azure Key Vault automatically.

Privileged Access Management

Replace standing admin credentials with just-in-time, identity-based sessions brokered through Infisical. Users authenticate with their SSO identity; Infisical grants scoped, time-limited access to PostgreSQL, SSH servers, Kubernetes, Active Directory, MySQL, and Redis. Every session is recorded and replayable, with AI-generated summaries for audit and compliance.

Agent Vault for AI Workloads

AI agents get access to external APIs through a credential proxy that attaches real secrets at the network boundary, so an agent never holds a credential it could leak from a prompt injection. Works with Claude Code, Codex, OpenCode, and any custom agent. Every request the agent makes is logged in an encrypted session log stored in your own Amazon S3 bucket.

Secret Scanning and Leak Prevention

Scans GitHub, GitLab, and Bitbucket repository histories and each new push for over 140 secret types. A CLI pre-commit hook blocks commits containing secrets before they reach the remote. Findings surface in the Infisical dashboard for triage and remediation alongside your managed secrets.

SDK and Kubernetes Operator

Client SDKs for Node.js, Python, Go, Ruby, Java, .NET, PHP, Rust, and C++ let applications fetch secrets directly from Infisical at runtime. The Kubernetes operator delivers secrets as native Kubernetes Secrets and automatically reloads deployments when secrets rotate. The Infisical Agent injects secrets into applications without code changes.

strengths · trade-offs

Strengths and trade-offs#

Strengths

One platform for secrets, certificates, PAM, and AI agent accessMost teams use separate tools for each of these: a secrets manager, a PKI solution, a PAM product, and agent-access tooling. Infisical covers all four in one platform with a shared identity model and single audit log. That means one fewer vendor, one fewer integration to maintain, and one audit trail across every credential type.
MIT-licensed core with no self-hosting restrictionsThe core platform is MIT licensed, permitting self-hosting for internal and commercial use with no licensing fees or usage restrictions. Teams can modify the source, fork it for their deployment environment, and run it commercially without restriction. The MIT license terms are confirmed in the repository's LICENSE file.
30,000+ stars and active developmentWith over 30,000 GitHub stars and 2,400+ forks, Infisical has one of the largest communities in the open source secrets management space. The repository saw its last push on November 4, 2026, and ships regular releases. Active development reduces the risk of adopting infrastructure software that gets abandoned.
Compliance-ready by designThe platform uses AES-256-GCM encryption, enforces strict access controls, and provides full audit logging with optional streaming to external providers. Both the cloud offering and self-hosted deployments are designed to meet SOC 2, HIPAA, and FIPS 140-3 requirements, covering healthcare, fintech, and enterprise security use cases.

Trade-offs

-Self-hosting requires Docker Compose and a Postgres databaseThe self-hosted deployment needs Docker Compose and a running Postgres instance. Getting the basic platform up takes one command locally, but production hardening requires configuring TLS, managing Postgres backups, setting up high-availability, and planning version upgrades with the Infisical Upgrade Tool. It is more involved than a single-binary deploy for a production environment.
-Full platform scope may outweigh the needInfisical ships secrets management, certificate PKI, PAM, KMS, and AI agent access as one integrated product. Getting full value from that breadth requires onboarding teams to multiple modules and maintaining access policies across each. Teams that only need secrets management will find the full platform over-specified; a narrower tool is simpler to operate in that case.
-276 open issues at time of researchThe repository has 276 open issues. For infrastructure software that manages production credentials, reviewing the open security-labeled issues before deploying is standard practice. Most issues cover feature requests and integrations, but any self-hoster should audit the issue tracker before committing to the platform for production use.

versus alternatives

Infisical vs alternatives#

Infisical vs HashiCorp Vault

HashiCorp Vault and Infisical both handle secrets storage and PKI at scale, but they diverge on scope and operational surface area.

Feature	Infisical	HashiCorp Vault
License	MIT (core)	Commercial
Self-hosting	Yes	Yes
Scope	Secrets, certs, PAM, KMS, Agent Vault	Primarily secrets and PKI
Web UI	Included	Requires enterprise tier
AI agent access	Agent Vault included	Not available

Infisical is the better choice for teams that want secrets, certificates, and privileged access in one MIT-licensed product without deep Vault expertise or enterprise licensing costs. HashiCorp Vault is worth considering if you already have Vault operators on staff, need its specific plugin ecosystem, or have existing Terraform Vault Provider workflows that would be costly to migrate.

Infisical vs Doppler

Doppler is a managed-only secrets management SaaS with no self-hosting path. Infisical runs on your own infrastructure with the same feature set as the cloud offering.

Feature	Infisical	Doppler
Self-hosting	Yes	No
License	MIT (core)	Proprietary
Certificate management	Yes	No
PAM	Yes	No
Pricing	Free (self-hosted)	Paid plans, free tier

Teams choosing between Infisical and Doppler often come down to data residency. If compliance requirements or cost constraints require running secrets on your own infrastructure, Doppler cannot serve that use case. Infisical is the choice when you need control over where secrets live. Doppler is worth considering for teams that want zero infrastructure management and are comfortable with a SaaS-only model.

Infisical vs AWS Secrets Manager

AWS Secrets Manager integrates tightly into the AWS ecosystem and handles secrets rotation for AWS services natively. Infisical is cloud-agnostic and covers a broader credential surface.

Feature	Infisical	AWS Secrets Manager
Self-hosting	Yes	No
Multi-cloud	Yes	AWS-only
Certificate management	Yes	No
PAM	Yes	No
Pricing	Free (self-hosted)	Per-secret, per-API-call fees

Infisical is the stronger choice for multi-cloud environments, teams running on-premises workloads, or organizations that need secrets management alongside certificate lifecycle and privileged access. AWS Secrets Manager is worth considering for AWS-native teams with tight IAM integration requirements and no need for infrastructure outside AWS.

install · quick start

Quick start#

bash

Self-hosting Infisical uses Docker Compose with a Postgres database included in the compose configuration.

```bash
git clone https://github.com/Infisical/infisical
cd infisical
cp .env.example .env
docker compose -f docker-compose.prod.yml up
```

tech stack · detected from GitHub

What it's built on#

Languages: GoTypeScript
Frameworks: React
Databases: MongoDBMySQLPostgreSQL
Infrastructure: AWSKubernetes
Search: Elasticsearch
Cache: Redis

frequently asked

FAQ#

Is Infisical free to use?

Yes: the core platform is MIT licensed and free to self-host on your own infrastructure. Infisical Cloud offers a free tier for small teams. Enterprise features under the ee/ directory carry a separate license that permits self-hosting for internal use but restricts reselling it as a managed service. For the vast majority of team self-hosting use cases, the core MIT features cover the essentials.

How does Infisical compare to HashiCorp Vault?

Infisical covers more ground in one product, handling secrets, certificates, PAM, KMS, and AI agent access. HashiCorp Vault is primarily a secrets and PKI engine with deep extensibility through plugins. Infisical ships a web UI and managed upgrade tooling out of the box; Vault requires more operational expertise to run at scale. Vault is the stronger choice if you already have Vault operators on staff, need its specific plugin ecosystem, or have existing Terraform Vault Provider workflows that would be costly to migrate.

Can I self-host Infisical on Kubernetes?

Yes. The Infisical docs cover Kubernetes deployment using Helm charts, with both single-node and high-availability configurations. The Infisical Kubernetes Operator integrates directly with workloads to deliver secrets as native Kubernetes Secrets and reload deployments on rotation. Postgres is required as the backing database.

What license covers Infisical's enterprise features?

The core platform is MIT licensed, covering secrets management, the web UI, the CLI, SDKs, integrations, and most features. Enterprise features under the ee/ directory carry a separate license that permits self-hosting for internal team and commercial use but restricts using those features to offer Infisical as a hosted managed service to third parties. Review the ee/ directory license in the repository before building a product that resells Infisical as a service.

Does Infisical support secret rotation for databases?

Yes. Infisical supports automated credential rotation for PostgreSQL, MySQL, AWS IAM users, and several other services. Dynamic secrets go further: instead of rotating a standing credential, Infisical generates a fresh, short-lived credential for each request and revokes it automatically when the session ends. This removes standing database credentials entirely for services that support it.

also worth a look

Similar open-source tools#

openbao

Alternative toHashiCorp Vault

Open source secret management governed by the Linux Foundation

8,832 GitHub stars
Licence MPL-2.0

Bitwarden

Alternative to1Password

Open source password manager with end-to-end encryption and self-hosting.

20,552 GitHub stars
Licence AGPL-3.0

Vaultwarden

Alternative toBitwarden

Lightweight self-hosted password manager server, Bitwarden compatible

70,224 GitHub stars
Licence AGPL-3.0

KeePass

Alternative to1Password

Free open source password manager with encrypted local file

57 GitHub stars
Licence GPL-3.0

KeePassXC

Alternative to1Password

Cross-platform open source password manager with browser plugin

29,691 GitHub stars

Passbolt

Alternative to1Password

Open source team password manager with sharing and audit

6,200 GitHub stars
Licence AGPL-3.0

by category

Open source tools in these categories#

161

Self-host Infisical on a Hostinger VPS

Keep it running 24/7, even when your laptop is off. A Hostinger VPS gives it a server of its own.

01
Choose a plan
Starts from $6.49/mo
02
Apply
Extra 10% off yearly plans
03
Install Infisical
On a server that stays on
04
Start building
Focus on the app, not the server

Deploy on Hostinger

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,889 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

6,568 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Infisical vs HashiCorp Vault

HashiCorp Vault and Infisical both handle secrets storage and PKI at scale, but they diverge on scope and operational surface area.

Feature	Infisical	HashiCorp Vault
License	MIT (core)	Commercial
Self-hosting	Yes	Yes
Scope	Secrets, certs, PAM, KMS, Agent Vault	Primarily secrets and PKI
Web UI	Included	Requires enterprise tier
AI agent access	Agent Vault included	Not available

Infisical vs Doppler

Doppler is a managed-only secrets management SaaS with no self-hosting path. Infisical runs on your own infrastructure with the same feature set as the cloud offering.

Feature	Infisical	Doppler
Self-hosting	Yes	No
License	MIT (core)	Proprietary
Certificate management	Yes	No
PAM	Yes	No
Pricing	Free (self-hosted)	Paid plans, free tier

Infisical vs AWS Secrets Manager

AWS Secrets Manager integrates tightly into the AWS ecosystem and handles secrets rotation for AWS services natively. Infisical is cloud-agnostic and covers a broader credential surface.

Feature	Infisical	AWS Secrets Manager
Self-hosting	Yes	No
Multi-cloud	Yes	AWS-only
Certificate management	Yes	No
PAM	Yes	No
Pricing	Free (self-hosted)	Per-secret, per-API-call fees

Who Infisical is for#

DevOps teams managing credentials across multiple environments

Skip if:

Security teams enforcing zero-standing-credentials on production infrastructure

Skip if:

Teams building or running AI agent workflows

Skip if:

Platform engineers setting up internal developer tooling

Skip if:

The problem it solves#

How it solves it#

Secrets Management with Rotation and Dynamic Secrets

Certificate Lifecycle Management

Privileged Access Management

Agent Vault for AI Workloads

Secret Scanning and Leak Prevention

SDK and Kubernetes Operator

Strengths and trade-offs#

Strengths

Trade-offs

Infisical vs alternatives#

Infisical vs HashiCorp Vault

Infisical vs Doppler

Infisical vs AWS Secrets Manager

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

DevOps & CI/CD

Developer Tools

Find open source alternatives to paid software

Who Infisical is for#

DevOps teams managing credentials across multiple environments

Skip if:

Security teams enforcing zero-standing-credentials on production infrastructure

Skip if:

Teams building or running AI agent workflows

Skip if:

Platform engineers setting up internal developer tooling

Skip if:

The problem it solves#

How it solves it#

Secrets Management with Rotation and Dynamic Secrets

Certificate Lifecycle Management

Privileged Access Management

Agent Vault for AI Workloads

Secret Scanning and Leak Prevention

SDK and Kubernetes Operator

Strengths and trade-offs#

Strengths

Trade-offs

Infisical vs alternatives#

Infisical vs HashiCorp Vault

Infisical vs Doppler

Infisical vs AWS Secrets Manager

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

DevOps & CI/CD

Developer Tools

Find open source alternatives to paid software